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DETAILED ACTION 

1. Claims 1-3, 5-14, 16-24, 26-38, 40 are pending. 

2. Claims 5, 16, and 26 are allowable. 

Response to Amendments 

3. Applicant's arguments have been fully considered, but are moot in view of the new 
grounds of rejection. 



Claim Rejections - 35 USC § 112 
4. The following is a quotation of the second paragraph of 35 U.S.C. 112: 

The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the 
subject matter which the applicant regards as his invention. 

Claims 1-3, 6-14, 16-24, 27-38, 40 are rejected under 35 U.S.C. 1 12, second paragraph, 
as being indefinite for failing to particularly point out and distinctly claim the subject matter 
which applicant regards as the invention. 

The Applicant has recited the newly amended independent claims with the following limitation: 
"wherein the downloaded changed security information is used to update a list of users or groups 
of users of at least one of files and resources associated with each of the plurality of servers." 
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The Examiner is uncertain what is being updated: 

• Is a "list" being updated? (wherein the list contains users "of files and resources" of the 
plurality of servers) 

• Or are "files and resources associated with the plurality of servers" being updated, where 
the "list of users" of these resources are the clients who should be informed of this 
update. 

For purposes of examination, the Examiner has taken the second interpretation. 

Furthermore, the Applicant has recited the limitation "a list of users or groups of users". 

Does the Applicant mean that there exists a physical/digital list of users, where the list may also 

recite groups of users? 

Or does the Applicant intend a broader claim where a list of users is loosely a set of users, or in 
the alternative (as applicant has recited), a "group of users". A "list of users" combined in the 
alternative form to a "group of users" implies that the two are synonymous, and that a "list of 
users" does not explicitly call for a physical/digital "list". 

For purposes of examination, the Examiner has taken the second interpretation. 



Claim Rejections - 35 USC §103 
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5. The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 

6. Claims 1-3, 6-14, 17-24, 27-38, 40 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over "Gannon University Norton Antivirus Configuration" and "Windows NT 
server 4.0". 

In reference to claim 1 : 

"Gannon University Norton Antivirus Configuration" discloses a method of updating security 
configurations of a plurality of servers, comprising: 

• Changing security information in a centralized server, where the security information 
changed is the virus definition file which the user will download, and the centralized 
server is the site the antivirus program downloads the virus definition from. Gannon 
(page 1, figure in the middle, virus definitions dated 9/22/1999) 

• Receiving an update command, where the update command is received through 
liveupdate to update the virus definition file. Gannon (page 3, figure at the top) 

• Downloading the changed security information to the plurality of servers in response to 
receiving the update command, wherein the downloaded changed security information is 
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used to update a list of users or groups of users of at least one of files and resources 
associated with each of the plurality of servers, where the changed security information is 
the new virus definition file and is downloaded to a plurality of servers in response to 
receiving the update command, and where the groups of users are the users who 
subscribed to the Norton Antivirus service Gannon (page 5, Item 5) 

"Gannon University Norton Antivirus Configuration" fails to explicitly disclose the method 
of claim 1, wherein a plurality of servers are updated. "Gannon University Norton Antivirus 
Configuration" instead teaches that a plurality of computers running Windows NT are 
updated. 

Windows NT server 4.0 discloses the Windows NT server software which may turn a 
computer into a server. As suggested by its name, Windows NT server 4.0 is a particular 
"flavor" of Windows NT. It is subset and a specific denomination of Windows NT. Running 
Windows NT server on a system would allow it to perform server functions, changing the 
nature of a computer to functionally be a "server". 

• "Gannon University Norton Antivirus Configuration" (page 1 , figure 1 , "using virus 
definitions dated 9/22/1999) and "Windows NT server 4.0" discloses the method of claim 
1 , wherein the security configurations of the plurality of servers are updated by updating 
security parameter lists associated with at least one of files and resources associated with 
each of the plurality of servers, where the security configuration is the configuration for 
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virus files, where the plurality of servers are the multiple clients using Norton antivirus 
running on windows NT server, and the security parameters are virus definitions, and the 
security parameter list is the list of virus definitions contained inherently contained in the 
virus definition file, and an update is performed using liveupdate. 

In light of the disclosure by "Gannon University Norton Antivirus Configuration" that each 
computer being updated may run "Windows NT", it would have been obvious to one of ordinary 
skill in the art at the time of invention to have each client of Norton Antivirus run the more 
specific flavor "Windows NT server" and to have the centralized liveupdate server run Windows 
NT server 4.0 in order to provide the advantage of greater software compatibility between each 
system. 

In reference to claim 2: 

"Gannon University Norton Antivirus Configuration" fails to explicitly disclose the method of 
claim 1, wherein the plurality of servers are windows NT servers and the centralized server is a 
directory server. 

"Gannon University Norton Antivirus Configuration" however does teach that Norton is 
compatible with a computer running windows NT. (Bottom of page 1) "Gannon University 
Norton Antivirus Configuration" also teaches that clients using Norton has the ability to check 
for virus updates from a centralized server. 
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Norton Antivirus(Page 1) teaches that windows NT servers may be used as the platform on 
which to run Norton. (This is meant as a reference to clarify details regarding the use Norton 
Antivirus and is not used in the 103 combination) 

"Gannon University Norton Antivirus Configuration" also does not teach if the centralized server 
is a directory server or not. 

The Examiner takes official notice that using Windows NT server was well known at the time of 
invention as it was a widely available commercial product. 

Windows NT server 4.0 (page 197) discloses that windows NT server may also act as a directory 
server. 

It would have been obvious to one of ordinary skill in the art at the time of invention to have 
each client of Norton Antivirus run on Windows NT server and to have the centralized 
liveupdate server run Windows NT server 4.0 within which directory server functions are 
performed in order to allow for greater compatibility between the clients (running windows NT 
server) and the centralized server (running windows NT server). 



In reference to claim 3: 
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Windows NT server 4.0 (page 199, figure 7.12) discloses method of claim 1, wherein the 
centralized server is a directory server and wherein changing the security information includes 
using an editor to change a directory listing in the centralized server. 



In reference to claim 6: 

"Gannon University Norton Antivirus Configuration" fails to disclose the method of claim 1, 
wherein the update command is received from a network administrator. 

A network administrator is merely a person, another user whose function it is to perform network 
administration tasks. The occupation of the client running Norton Antivirus can be anyone: a 
banker, a student, a lawyer, or a painter or anyone that wishes to use Norton Antivirus. 

"Gannon University Norton Antivirus Configuration" (page 3) discloses the person who sends 
the update command is whoever is using the software at the time. 

It would have been obvious to one of ordinary skill in the art at the time of invention for a 
network administrator to send the update command in order for the network administrator to 
perform his or her job duties of providing security for the network. 

In reference to claim 7: 
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"Gannon University Norton Antivirus Configuration" (page 3) discloses the method of claim 1, 
wherein the update command is received at scheduled periodic times. 

In reference to claim 8: 

"Gannon University Norton Antivirus Configuration"(page 3) and "Windows NT server 4.0" 
discloses method of claim 1, wherein the update command is received from one or more of the 
plurality of servers, where the update command is received from a user running Norton antivirus 
on windows NT server. 

In reference to claim 9: 

"Gannon University Norton Antivirus Configuration" and "Windows NT server 4.0" fails to 
disclose a method wherein the centralized server is a light weight directory access protocol 
server. 

The examiner takes official notice that the lightweight directory access protocol, or 
LDAP is well known to those of ordinary skill in the art. LDAP defines a standard manner of 
organizing directory hierarchies and a standard interface for clients to interface with access 
directory servers. 

It would have been obvious to one of ordinary skill in the art to use the lightweight 
directory access protocol in the central server because LDAP has broad industry support, and 
runs directly over TCP/IP. 



In reference to claim 10: 
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"Gannon University Norton Antivirus Configuration" discloses the method of claim 1, wherein 
downloading the changed security information includes filtering a directory listing stored on the 
centralized server to extract the changed security information, where the filtering of a directory 
listing to extract the security information is inherent. 

Norton Antivirus downloads a virus definition file from a centralized server. The centralized 
server, owned by Symantec systems periodically updates to create new virus definition files. It 
is inherent that the virus definition file that the client download be located in a directory structure 
of some kind. For example: 
C:\my documents\new files\virus_updates.dat 

To access this file, a directory listing is inherently filtered through to access that file. 
In reference to claim 1 1 : 

"Gannon University Norton Antivirus Configuration" discloses the method of claim 1, wherein 
the security configurations are updated by filtering the downloaded changed security information 
to extract only necessary update information for updating the security configurations and then 
updating the security configurations based on the extracted necessary update information, where 
the information necessary to update the security information taken is the virus definition file and 
the updating process once the file has been downloaded is inherent to Norton Antivirus. 
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In reference to claim 32: 

"Gannon University Norton Antivirus Configuration" & "Norton Antivirus 5.0 for Windows NT 
Servers" discloses method in a data processing system for updating access information for a 
plurality of servers, the method comprising: 

• Collecting changes to access information at the data processing system to form modified 
access information, where the access information is virus definition information which is 
accessed from the central server, and the changes are collected to form a newly updated 
set of virus identification collected by antivirus research center. "Gannon Norton 
Antivirus 5.0 for Windows NT Servers" page 4-5 

• Responsive to a policy, transferring the modified access information to the plurality of 
servers, wherein the modified access information is used to update a list of users or 
groups of users of at least one of files and resources associated with the plurality of 
servers, where the policy is simply a rule dictating when the transfer of data or the update 
is to take place. "Gannon University Norton Antivirus Configuration" (page 3), and 
where the access information, the virus definition file, is transferred in update process. 
"Gannon University Norton Antivirus Configuration" (page 4), and where the group of 
users are the users who subscribed to the Norton Antivirus service. 

No motivation is required to combine, because it is understood that "Norton Antivirus 5.0 for 
Windows NT Servers" is a reference which provides more details as to the nature of Norton 
Antivirus, the use of which has already been disclosed by "Gannon University Norton Antivirus 
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Configuration", and the combination with windows NT which has been established as set forth in 
the rejection of claim 2. 

Claims 13, 38 are rejected for the same reasons as claim 2. 
Claim 24 is rejected for the same reasons as claim 3. 
Claims 17, 27 are rejected for the same reasons as claim 6. 
Claims 19, 29 are rejected for the same reasons as claim 8. 
Claims 20, 30 are rejected for the same reasons as claim 9. 
Claims 12, 23, 37 are rejected for the same reasons as claim 1. 
Claims 18, 28, 34, 36 are rejected for the same reasons as claim 7. 
Claims 21, 31 are rejected for the same reasons as claim 10. 
Claim 22 is rejected for the same reasons as claim 11. 



Conclusion 

7. The following art of record not relied upon is made of record: 

• US patent 5151989 discloses a distributed data processing system with abstract that reads 
as follows: 

An improved directory caching technique is provided for a plurality of data 
processing systems which are connected together in a network In the system, 
when a local, or client, data processing system interrogates a remote, or 
ser\>er t data processing system for a unit of directory information, the server 
system is enabled to automatically send additional units of pertinent director 
information back to the client system in response to a subsequent change in the 
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directory structure of the server system. If the server system is unable to 
continue updating the client system, for any of a plurality of possible 
reasons, the server system informs the client system of this fact, which 
enables the client system to purge itself of the formerly stored directory 
cache entry relative to this path, since the client system can no longer 
consider this cached path information to be currently correct 



• US patent 5790848 is a method and apparatus for data access and update in a shared file 
environment 

• US patent 583591 1 describes a software update and distribution method with abstract that 
reads as follows: 

A number of sets of software may be systematically distributed and 
maintained via a network connecting many vendors and users of client /server 
software. A client program in a user computer detects when software subject to 
maintenance is activated and transmits an inquiry over the network to the 
software vendor's computer for information on the current version of the 
software. The server program compares data in the inquiry with data relating 
to the latest version of the software and returns update instruction 
information and updated software if appropriate. The client program 
automatically updates the software to the latest version according to the 
update instruction information when it is received. The client program can 
also send inquires at predetermined times, or in response to a user command. 
The inquiry can include a request for purchase information in which case the 
server checks qualifications of the user, processes the inquiry according to 
vendor management data and returns the requested software, if appropriate. 
Other inquiries can also be made in response to user commands or automatically, 
e.g., to obtain information on the most recent version and transmission of data 
from client to server in response to an abnormal termination of client 
software. 



8. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy 
as set forth in 37 CFR 1.136(a). 
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A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within TWO 
MONTHS of the mailing date of the final action and the advisory action is not mailed under after 
the end of the THREE-MONTH shortened statutory period, then the shortened statutory period 
will expire on the date the advisory action is mailed, and any extension pursuant to 37 CFR 
1.136(A) will be calculated from the mailing date of the advisory action. In no event, however, 
will the statutory period for reply expire later than SIX MONTHS from the mailing date of this 
final action. 

9. Any inquiry concerning this communication from the examiner should be directed to 
Thomas M Ho whose telephone number is (571)272-3835. The examiner can normally be 
reached on M-F from 9:30 AM - 6:00 PM. 

If attempts to reach the examiner by telephone are unsuccessful, the examinees supervisor, 
Gregory A. Morse can be reached on (571)272-3838. 

The Examiner may also be reached through email through Thomas.Ho6@usDto.eov 

Any inquiry of a general nature or relating to the status of this application or proceeding should 

be directed to the receptionist whose telephone number is (571)272-2100. 

General Information/Receptionist Telephone: 571-272-2100 Fax: 571-273-8300 
Customer Service Representative Telephone: 571-272-2100 Fax: 571-273-8300 
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